Cyrene_v2/internal/services/gateway/rest.go

package gateway

import (
	"encoding/json"
	"net/http"
	"strings"
	"time"

	"git.yeij.top/AskaEth/Cyrene_v2/internal/auth"
	"git.yeij.top/AskaEth/Cyrene_v2/internal/channel/session"
	apperr "git.yeij.top/AskaEth/Cyrene_v2/internal/errors"
	"git.yeij.top/AskaEth/Cyrene_v2/internal/persona/loader"
	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/loop"
	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/model"
)

// tokenTTL is how long an issued JWT remains valid.
const tokenTTL = 24 * time.Hour

// PersonaSummary is the wire shape of a persona in REST/admin list responses.
type PersonaSummary struct {
	ID        string `json:"id"`
	Name      string `json:"name"`
	Character string `json:"character"`
	IsDefault bool   `json:"isDefault"`
	Mode      string `json:"mode"`
	MemoryNS  string `json:"memoryNamespace"`
	Avatar    string `json:"avatar,omitempty"`
	// ChatBackground holds per-orientation wallpaper; a role's own, never another's.
	ChatBackground ChatBackgroundSummary `json:"chatBackground,omitempty"`
	// Mood is the role's current emotion state (design/01 §2: emotion follows the
	// role, never a session). "" means the role has no tracked emotion — an honest
	// empty, never a fabricated default. Clients seed their mood badge from it so a
	// refresh no longer flashes an empty mood.
	Mood string `json:"mood"`
	// Thinking carries the persona's optional reasoning/presentation block
	// (design/01 §2.1). It is nil — and so absent from the JSON — when the persona
	// configures none, mirroring the write side's "an omitted block keeps the
	// stored one". Admin list only: these are model-call knobs, not user-UI state
	// (the user list takes Mood and leaves the knobs to the panel).
	Thinking *PersonaThinkingSummary `json:"thinking,omitempty"`
}

// PersonaThinkingSummary mirrors a persona's `thinking` block on the wire
// (design/01 §2.1; provider mapping in design/04 §3.2).
type PersonaThinkingSummary struct {
	// BudgetTokens is the reasoning budget (Anthropic thinking.budget_tokens).
	BudgetTokens int `json:"budgetTokens"`
	// Effort is the provider-specific reasoning strength (reasoning_effort). The
	// model layer validates it against the active provider's whitelist and WARNs
	// when it is dropped — this side just reports what is stored.
	Effort string `json:"effort"`
	// ShowToUser is TRI-STATE and stays that way on the wire: null = not
	// configured (thinking frames keep flowing — the pre-existing behavior),
	// true/false = an explicit choice. A plain bool would flatten "unset" onto
	// "off" and lose the distinction the write side keeps with *bool.
	ShowToUser *bool `json:"showToUser"`
	// Mode is the explicit hard switch: default | on | off ("" = default).
	Mode string `json:"mode"`
}

// ChatBackgroundSummary mirrors the persona chatBackground on the wire.
type ChatBackgroundSummary struct {
	Landscape string `json:"landscape,omitempty"`
	Portrait  string `json:"portrait,omitempty"`
}

// MemorySummary is the wire shape of a memory entry in the admin list response.
type MemorySummary struct {
	ID    string `json:"id"`
	Scope string `json:"scope"`
	Text  string `json:"text"`
}

// SessionSummary is the wire shape of a channel session in list responses.
type SessionSummary struct {
	Platform  string `json:"platform"`
	ChannelID string `json:"channelId"`
	SessionID string `json:"sessionId"`
	ActorRole string `json:"actorRole"`
	Owner     bool   `json:"owner"`
	IsGroup   bool   `json:"isGroup"`
	MemWrite  bool   `json:"memWritable"`
}

// loginRequest is the POST /api/v1/auth/login body.
type loginRequest struct {
	Username string `json:"username"`
	Password string `json:"password"`
}

// loginResponse is the login success payload. RefreshToken is the opaque
// long-lived credential (POST /auth/refresh) added by B2; it is omitted when no
// refresh store is wired so the pre-B2 contract is unchanged.
type loginResponse struct {
	Token        string `json:"token"`
	ExpiresAt    int64  `json:"expiresAt"`
	Role         string `json:"role"`
	RefreshToken string `json:"refreshToken,omitempty"`
}

// chatRequest is the POST /api/v1/chat body. When Stream is true the gateway
// triggers streaming over the WebSocket channel and returns immediately. Image is
// an optional base64 data: URI or http(s) URL attached for the vision path; the
// loop routes it through the vision/OCR tool or the main model (design/06 §0).
// DeviceID is the client-produced identifier of the sending browser/device
// (design/16 §4.5), e.g. "web:chrome:a1b2c3"; it is optional and persisted as-is.
// Mode is the behavior mode the client sent the turn in (design/01 §3, design/16
// §5.1); it is optional and persisted per message for bubble rendering, falling
// back to "chat" when omitted.
type chatRequest struct {
	SessionID string `json:"sessionId"`
	Text      string `json:"text"`
	Image     string `json:"image,omitempty"`
	DeviceID  string `json:"deviceId,omitempty"`
	Mode      string `json:"mode,omitempty"`
	Stream    bool   `json:"stream"`
}

// chatResponse is the synchronous chat reply payload.
type chatResponse struct {
	Reply      string `json:"reply"`
	Steps      int    `json:"steps"`
	StopReason string `json:"stopReason"`
}

// handleHealth reports liveness. It is unauthenticated because it is a probe.
func (s *Server) handleHealth(w http.ResponseWriter, r *http.Request) {
	writeJSON(w, http.StatusOK, map[string]any{"status": "ok"})
}

// handleLogin exchanges the admin username/password for a signed JWT.
func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
	var req loginRequest
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "invalid request body"))
		return
	}
	cfg := s.cfg.Auth
	if req.Username != cfg.AdminUser || req.Password != cfg.AdminPass {
		writeError(w, apperr.Wrap(apperr.ErrUnauthorized, "unauthorized", "invalid username or password"))
		return
	}
	token, err := s.auth.Sign(req.Username, auth.RoleOwner, tokenTTL)
	if err != nil {
		s.log.Error("login sign", "err", err)
		writeError(w, apperr.Wrap(apperr.ErrInternal, "login_failed", "could not sign token"))
		return
	}
	resp := loginResponse{
		Token:     token,
		ExpiresAt: time.Now().Add(tokenTTL).Unix(),
		Role:      string(auth.RoleOwner),
	}
	// Issue the long-lived refresh credential alongside the access token. A store
	// failure fails the login rather than silently handing back a login without
	// the advertised refresh token; the plaintext is never logged.
	if s.refresh != nil {
		refreshToken, _, rerr := s.refresh.Issue(r.Context(), req.Username, auth.RoleOwner, s.refreshTTL())
		if rerr != nil {
			s.log.Error("login issue refresh token", "err", rerr)
			writeError(w, apperr.Wrap(apperr.ErrInternal, "login_failed", "could not issue refresh token"))
			return
		}
		resp.RefreshToken = refreshToken
	}
	writeJSON(w, http.StatusOK, resp)
}

// handleChat runs one synchronous agent turn (or triggers streaming).
func (s *Server) handleChat(w http.ResponseWriter, r *http.Request) {
	var req chatRequest
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "invalid request body"))
		return
	}
	if strings.TrimSpace(req.Text) == "" && strings.TrimSpace(req.Image) == "" {
		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "text or image is required"))
		return
	}
	if req.Stream {
		s.publishChatStream(r.Context(), req.SessionID, req.Text, req.Image, req.DeviceID, req.Mode)
		writeJSON(w, http.StatusOK, map[string]any{"stream": true})
		return
	}
	if s.runner == nil {
		writeError(w, apperr.Wrap(apperr.ErrInternal, "chat_unavailable", "chat service is not configured"))
		return
	}
	if req.SessionID == "" {
		req.SessionID = "web"
	}
	// The Web main session is the owner's private conversation (JWT = owner), so
	// it binds the full-access env: memory read+write, unchanged behavior. The role
	// comes from the session's binding (design/22 §4.5).
	msgs := userChatMessages(req.Text, req.Image)
	env := s.envResolver.owner(r.Context(), req.SessionID)
	if s.hub.orchestrator != nil {
		sr, res := s.hub.orchestrator.SubmitSync(withMode(withDeviceID(r.Context(), req.DeviceID), req.Mode), req.SessionID, msgs, env)
		if !sr.Accepted {
			if sr.PendingFull {
				writeError(w, apperr.Wrap(apperr.ErrConflict, "chat_busy", "会话正忙，待处理消息已满"))
			} else {
				writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "text or image is required"))
			}
			return
		}
		// A busy session returns a non-blocking ack (design/15 §2.1) instead of
		// blocking the request on a turn that may run for a while.
		if sr.Pending {
			writeJSON(w, http.StatusAccepted, map[string]any{"queued": true, "queueDepth": sr.QueueDepth})
			return
		}
		if sr.Err != nil {
			s.log.Error("chat run", "err", sr.Err, "session", req.SessionID)
			writeError(w, apperr.Wrap(apperr.ErrInternal, "chat_failed", "chat failed"))
			return
		}
		writeJSON(w, http.StatusOK, chatResponse{Reply: res.Text, Steps: res.Steps, StopReason: res.StopReason})
		return
	}
	// Legacy synchronous path when no orchestrator is wired (a hub built without
	// one keeps the exact pre-design/15 reply contract).
	res, err := s.runner.Run(loop.WithSessionEnv(r.Context(), env), req.SessionID, msgs)
	if err != nil {
		s.log.Error("chat run", "err", err, "session", req.SessionID)
		writeError(w, apperr.Wrap(apperr.ErrInternal, "chat_failed", "chat failed"))
		return
	}
	writeJSON(w, http.StatusOK, chatResponse{Reply: res.Text, Steps: res.Steps, StopReason: res.StopReason})
}

// handleListSessions returns the persistent chat-history sessions (main + sub) when a
// history store is wired, otherwise falls back to the channel-session view. The fallback
// keeps the pre-design/16 contract: a server built without history still lists the known
// channel sessions (or [] when no store is wired).
func (s *Server) handleListSessions(w http.ResponseWriter, r *http.Request) {
	if s.history != nil {
		s.handleHistorySessions(w, r)
		return
	}
	out := make([]SessionSummary, 0)
	if s.sessions != nil {
		list, err := s.sessions.List(r.Context())
		if err != nil {
			s.log.Error("list sessions", "err", err)
			writeError(w, apperr.Wrap(apperr.ErrInternal, "sessions_failed", "failed to list sessions"))
			return
		}
		for _, sess := range list {
			out = append(out, summaryOfSession(sess))
		}
	}
	writeJSON(w, http.StatusOK, out)
}

// handleListPersonas returns the personas (or [] when no store is wired). It is
// the user-side shape: the role-level mood rides along, the admin-only thinking
// knobs do not.
func (s *Server) handleListPersonas(w http.ResponseWriter, r *http.Request) {
	writeJSON(w, http.StatusOK, s.collectPersonas(false))
}

// collectPersonas returns a non-nil persona slice from the configured store.
// withThinking adds the admin-only `thinking` block; mood is always reported
// because the user UI renders the badge.
func (s *Server) collectPersonas(withThinking bool) []PersonaSummary {
	out := make([]PersonaSummary, 0)
	if s.personas == nil {
		return out
	}
	for _, c := range s.personas.List() {
		id := c.PersonaID
		if id == "" {
			id = c.ID
		}
		sum := PersonaSummary{
			ID:        id,
			Name:      c.Name,
			Character: c.Name,
			IsDefault: c.Default,
			Mode:      firstMode(c.Modes),
			Mood:      s.moodOf(id),
		}
		// Read this persona's own visual assets (avatar / chat background). Each
		// role carries its own; a missing persona or unset visual yields empty,
		// never another role's — the frontend falls back to a neutral default.
		if p, ok := s.personas.Persona(id); ok && p != nil {
			if p.Visual.Avatar != "" {
				sum.Avatar = p.Visual.Avatar
			}
			if p.Visual.ChatBackground.Landscape != "" || p.Visual.ChatBackground.Portrait != "" {
				sum.ChatBackground = ChatBackgroundSummary{
					Landscape: p.Visual.ChatBackground.Landscape,
					Portrait:  p.Visual.ChatBackground.Portrait,
				}
			}
			sum.Thinking = thinkingSummaryOf(p.Thinking, withThinking)
		}
		out = append(out, sum)
	}
	return out
}

// moodOf reports the role's current emotion state. Emotion is owned by the
// persona store (design/01 §2), read through the optional PersonaMoodStore
// capability; a store that does not track emotion, or a role with no machine,
// reports "" instead of a made-up mood.
func (s *Server) moodOf(id string) string {
	store, ok := s.personas.(PersonaMoodStore)
	if !ok {
		return ""
	}
	emotions := store.Emotions()
	if emotions == nil {
		return ""
	}
	machine, _, ok := emotions.Get(id)
	if !ok || machine == nil {
		return ""
	}
	return string(machine.Current())
}

// thinkingSummaryOf maps a stored thinking block onto the wire. It returns nil
// when the persona configures none — the key is then absent, so a client can tell
// "not configured" from an explicit value (the read-side mirror of the write-side
// rule that an omitted block keeps the stored one). include is false for the
// user-side list, which does not carry these knobs.
func thinkingSummaryOf(t loader.ThinkingParams, include bool) *PersonaThinkingSummary {
	if !include || !thinkingConfigured(t) {
		return nil
	}
	return &PersonaThinkingSummary{
		BudgetTokens: t.BudgetTokens,
		Effort:       t.Effort,
		ShowToUser:   t.ShowToUser,
		Mode:         t.Mode,
	}
}

// thinkingConfigured reports whether any thinking knob is set. An empty block
// must read as "not configured" rather than as an all-zero object.
func thinkingConfigured(t loader.ThinkingParams) bool {
	return t.BudgetTokens != 0 || t.Effort != "" || t.ShowToUser != nil || t.Mode != ""
}

// firstMode returns the first declared behavior mode, or "" when none are set.
func firstMode(modes []string) string {
	if len(modes) == 0 {
		return ""
	}
	return modes[0]
}

// userChatMessages builds the user turn for a chat / stream request. When image is
// present the turn becomes an image message (with optional text); otherwise a
// plain text message. An empty text with an image yields an image-only turn.
func userChatMessages(text, image string) []model.Message {
	if strings.TrimSpace(image) != "" {
		return []model.Message{model.ImageMessage(model.RoleUser, text, image)}
	}
	return []model.Message{model.TextMessage(model.RoleUser, text)}
}

// summaryOfSession maps a session.Session to its wire shape.
func summaryOfSession(sess session.Session) SessionSummary {
	return SessionSummary{
		Platform:  sess.Platform,
		ChannelID: sess.ChannelID,
		SessionID: sess.SessionID,
		ActorRole: string(sess.ActorRole),
		Owner:     sess.Owner,
		IsGroup:   sess.IsGroup,
		MemWrite:  sess.MemWritable,
	}
}

// writeJSON encodes v as the {data: v} envelope with the given status.
func writeJSON(w http.ResponseWriter, status int, v any) {
	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(status)
	_ = json.NewEncoder(w).Encode(map[string]any{"data": v})
}

// writeError encodes err as the {error:{code,message}} envelope with the status
// resolved by apperr.HTTPStatus.
func writeError(w http.ResponseWriter, err error) {
	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(apperr.HTTPStatus(err))
	_ = json.NewEncoder(w).Encode(apperr.ToJSON(err))
}